QCubed SQL Injection ================== | Identifier: | AIT-SA-20210215-02 | | Target: | QCubed Framework | | Vendor: | QCubed | | Version: | all versions including 3.1.1 | | CVE: | CVE-2020-24913 | | Accessibility: | Remote | | Severity: | Critical | | Author: | Wolfgang Hotwagner (AIT Austrian Institute of Technology) | SUMMARY ======= QCubed is a PHP Model-View-Controller Rappid Application Development framework. (https://github.com/qcubed/qcubed) VULNERABILITY DESCRIPTION ========================= A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request. The strQuery parameter of the serialized array in profile.php could lead to a sql-injection. This parameter is used by the PrintExplainStatement which simply concats "EXPLAIN ." with this parameter: public function ExplainStatement($sql) { return $this->Query("EXPLAIN " . $sql); } This query will be executed unfiltered. We were able to write proof-of concept exploit for mysql and postgres. Unfortunately with mysql we were not able to use a stacked-queries-payload and we had to exploit this vulnerability with a timebased approach. VULNERABLE VERSIONS =================== All versions including 3.1.1 are affected. TESTED VERSIONS =============== QCubed 3.1.1 IMPACT ====== An unauthenticated attacker could access the database remotely. In worst case scenarios an attacker might be able to execute code on the remote machine MITIGATION ========== A patch was delivered by QCubed that allows to disable the profile-functionality( https://github.com/qcubed/qcubed/pull/1320/files ). VENDOR CONTACT TIMELINE ======================= | 2020-04-19 | Contacting the vendor | | 2020-04-19 | Vendor replied | | 2020-05-01 | Vendor released a patch at Github | | 2021-02-15 | Public disclosure | ADVISORY URL ============ [https://www.ait.ac.at/ait-sa-20210215-02-unauthenticated-sql-injection-qcubed](https://www.ait.ac.at/ait-sa-20210215-02-unauthenticated-sql-injection-qcubed)